docs: cover self-revoking edits and the last-admin guard

docs/admin/daily-operations.md

@@ -135,6 +135,18 @@ quota) that's fine, just mirror the change in Git.
 - Manual group edits (Users page) are the path when OIDC is not
   configured — and are overwritten at the user's next SSO login when it
   is.
+- **Keep a second administrator.** Demoting or deactivating the last
+  active admin is refused, because nothing in the product could undo it —
+  `WAAS_ADMIN_PASSWORD` only seeds an empty user table, so not even a
+  redeploy brings the role back. Promote the replacement first; the
+  order matters.
+- **Editing your own account signs you out immediately**, by design: a
+  role change, a deactivation or a password reset revokes every session
+  of that account, yours included. From the console that means a
+  self-demotion (the edit dialog carries role, quota and groups);
+  deactivation and password reset are API-only on an existing account.
+  Expect to sign in again — with the new rights — right after doing it.
+  Editing *someone else's* account never touches your own session.
 
 ### Watching the platform
 

docs/concepts/governance.md

@@ -210,6 +210,44 @@ these are **immediate**, without waiting for any token to expire:
 | Reset or change a password | Existing sessions end |
 | Sign out | Every session of that account ends |
 
+**When the target is you, you are signed out on the spot** — not on your
+next click. Changing your own password on the Profile page, demoting
+yourself from the Users page, or deactivating / password-resetting your
+own account through the API, ends the session that made the change: the
+portal returns you to the login page with a notice naming what happened,
+rather than looking signed in until something 401s. Signing you back in
+on the spot would not work either: the new session would be issued in the
+same second as the revocation and be refused by it.
+
+:::warning You cannot strand the platform without an administrator
+
+Demoting or deactivating the **last active administrator** is refused:
+
+```
+the platform must keep at least one active administrator — promote another
+account first
+```
+
+There is no way back from zero admins through the product. The
+`WAAS_ADMIN_PASSWORD` bootstrap only ever seeds an **empty** user table —
+it never re-applies to an existing account, so a redeploy would not
+restore your access. Recovering would mean editing the database by hand.
+
+Promote a second administrator *first*, then demote yourself.
+
+Two cases the rule deliberately leaves alone:
+
+- **Your IdP.** With `adminGroups` configured, removing someone's admin
+  group demotes them at their next login, last admin or not — the
+  directory owns the role. That one *is* recoverable: put the group back
+  and sign in again.
+- **`disableLocalLogin` deployments.** The rule is off entirely, because
+  the break-glass exists there (redeploy without the flag, sign in as the
+  bootstrap admin) and because it would otherwise block the cleanup of a
+  local admin account nobody can sign into any more.
+
+:::
+
 :::warning Signing out is global, not per device
 
 Signing out on one browser ends that account's sessions **everywhere**.

docs/troubleshooting.md

@@ -36,6 +36,37 @@ A user whose group mirror is empty matches only subjects-less policies —
 that's the "everyone gets the default policy" symptom, not a priority
 bug: groups sync from the IdP at every SSO login (or via admin edit).
 
+## I was signed out right after changing something about myself
+
+Expected, and it is the platform telling you so rather than hiding it.
+Changing your password (Profile page), demoting yourself (Users page) or
+deactivating / password-resetting your own account through the API
+revokes **every** session of that account — the one you did it from
+included. The portal returns you to the login page with a notice naming
+the reason instead of waiting for the next request to fail.
+
+You cannot be signed back in on the spot: the replacement session would
+be minted in the same second as the revocation and refused by it. Sign in
+again with the new password or the new rights.
+
+Two things this is **not**: editing someone else's account never touches
+your own session, and an edit that revokes nothing (a quota bump on
+yourself, for instance) leaves you signed in. If you were signed out
+without changing anything, read the next section instead.
+
+## I cannot demote or deactivate my own admin account
+
+```
+the platform must keep at least one active administrator — promote another
+account first
+```
+
+You are the last active administrator. The refusal is deliberate: there
+is no in-product way back from zero admins, and `WAAS_ADMIN_PASSWORD`
+only seeds an **empty** user table — a redeploy would not restore the
+role, only a manual database edit would. Promote another account to
+admin, then retry.
+
 ## A user cannot log in via SSO
 
 The login page always shows the same generic message — *"SSO login